TI-2026-58042 Aliases CVE-2026-84452 GHSA-96p9-rh4f-92cf

Windows ML CLI: CORS misconfig enables localhost RCE

HIGH 72CWE-306Published 2026-09-02 · Updated 2026-09-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.

Summary

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cli_api.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the allow_origins setting as a wildcard in both src/winml/modelkit/serve/cli_api.py and src/winml/modelkit/serve/app.py. A malicious website loaded by a user can send cross-origin requests to /v1/cli/build or /v1/cli/config and set the trust_remote_code parameter to true, which is converted to the --trust-remote-code command-line flag without validation. This reaches AutoConfig.from_pretrained with trust_remote_code=True in src/winml/modelkit/loader/_autoconfig.py and imports Python code from an attacker-controlled model repository, resulting in arbitrary code execution as the server user. This issue is fixed in version 0.4.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01608 76th percentileScored 2026-11-07

Fix Fixed winml-cli (microsoft): 0.4.0winml-cli (PyPI): 0.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	winml-cli	before 0.4.0	0.4.0	Patch available	CNA
—	winml-cli (PyPI)	before 0.4.0	0.4.0	Patch available	GHSA-96p9-rh4f-92cf

winml-cli VendorMicrosoft Affected before 0.4.0 Fixed in 0.4.0 Patch available CNA
winml-cli (PyPI) Vendor— Affected before 0.4.0 Fixed in 0.4.0 Patch available GHSA-96p9-rh4f-92cf

Remediation

Fix · CNA winml-cli (microsoft) Fixed in 0.4.0
Fix · GHSA-96p9-rh4f-92cf winml-cli (PyPI) Fixed in 0.4.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-84452
2026-10-03 Alias added: GHSA-96p9-rh4f-92cf

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-84452

Other 4

TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8

See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences